The other day in one of the Android TV related threads somebody posted a Github repo for an AndroidTV browser app with a rich suite of functionality. I pulled the repo down and asked Claude to scan it because I was concerned about security issues and vibe-coded vulnerabilities. It got about half way through the scan and abruptly stopped, refusing to scan it more nor would it say exactly why it stopped or what it found, only that it was a "security" issue.

Needless to say, I ditched the repo. The problem is I don't know if what it found was legitimate or simply a keyword that set off alarm bells or if my prompt was falsely detected of being malicious. It's very frustrating. When I researched more on this topic, I found users complaining about the same issue when asking Claude to scan new releases of legitimate npm packages (a popular library like react-query for example).

They've simultaneously cultivated a medium for faster and more devastating exploits with no good way of protecting ourselves from them. It's ridiculous.